Victor Julien
60285a629f
detect: remove unused function
4 years ago
Juliana Fajardini
f897761ecb
detect/alert: add unittests to check packet action
...
Add unittests to check that packet flags are correctly updated after
detection finds drop or reject rules that match.
Related to
Bug #5458
4 years ago
Juliana Fajardini
192360aa05
detect: update copyright years
5 years ago
Juliana Fajardini
e4e688a9b0
detect/alert: remove unused functions
...
Since we now only copy the PacketAlerts to the Packet's queue after
processing them, we no longer do packet alert appending from
detect-engine-alert, nor do we remove PacketAlerts from the queue (if
they're discarded by overflow or thresholding, they're not copied to the
final alert queue).
Task #4943
5 years ago
Juliana Fajardini
88805f03ee
detect/alert: add infra for new alert queue
...
Initial work to bring part of the alert queue processing to
DetectEngineThreadCtx.
Task #4943
5 years ago
Victor Julien
bfd4bc8233
detect: constify Signature/SigMatch use at runtime
10 years ago
Victor Julien
edeeb7ed44
Store TX id with alerts
...
When generating an alert and storing it in the packet, store the tx_id
as well. This way the output modules can log the tx_id and access the
proper tx for logging.
Issue #904 .
13 years ago
Victor Julien
ea0d172693
No longer pass StreamMsg to output for alert logging, instead use the same callback code as is used for state alerts.
15 years ago
Victor Julien
75439863ed
Shrink PacketAlerts structure so that Packet structure is a lot smaller. Reduce max events per packet from 256 to 15.
16 years ago
Victor Julien
864c8718e1
Store matching stream msg (ptr) in packets alert structure so it's available to the output plugins.
16 years ago
Pablo Rincon
5c43db85ce
Drop streams on inline mode when a drop rule match from a reassembled stream and/or app layer inspection
16 years ago
Pablo Rincon
868d4614b9
Tag engine improvements. Output tags only on unified format. Added atomic counter for tagged hosts/sessions
17 years ago
Pablo Rincon
eed0ef6e69
Adding tag keyword support
17 years ago
William Metcalf
2eef905c07
GPL and Copyright header updates.
17 years ago
Victor Julien
42eeb84c9a
Properly lock flow before setting IP only action flags. Small alert api cleanups.
17 years ago
Pablo Rincon
9bae6a8628
Moving alert logic to detect-engine-alert.c
17 years ago
Pablo Rincon
e18e2ec998
Changing threshold logic
17 years ago